Toml Node
Monthly
Uncontrolled recursion in toml-node (npm package `toml`, ~47 million monthly downloads) allows remote unauthenticated attackers to crash any Node.js process that parses attacker-controlled TOML input. The Peggy 5.1.0-generated recursive-descent parser has no depth limit in the mutual recursion between `peg$parsevalue`, `peg$parsearray`, and `peg$parseinline_table_entry`; a ~5-6 KB payload of deeply nested arrays reliably exhausts the call stack and raises an uncatchable `RangeError` that terminates the request worker or process. A confirmed PoC is documented in the GHSA advisory; a patch is available in version 4.2.0 released July 13, 2026.
Prototype pollution in toml-node (npm package `toml` by BinaryMuse) prior to 4.1.2 allows unauthenticated remote attackers to write arbitrary keys onto Object.prototype by supplying a crafted TOML document to `toml.parse()`. The vulnerability exploits a path desynchronization bug in the compiler's duplicate-key guard - comma-joined tracking paths diverge from dot-joined traversal paths, allowing `__proto__` traversal through scalar values into the real JavaScript prototype chain. Injected properties propagate process-wide in Node.js and can enable denial of service, authorization bypass, or code execution via application gadget chains; the GHSA advisory includes working proof-of-concept code, and a fix is available in version 4.1.2.
Uncontrolled recursion in toml-node (npm package `toml`, ~47 million monthly downloads) allows remote unauthenticated attackers to crash any Node.js process that parses attacker-controlled TOML input. The Peggy 5.1.0-generated recursive-descent parser has no depth limit in the mutual recursion between `peg$parsevalue`, `peg$parsearray`, and `peg$parseinline_table_entry`; a ~5-6 KB payload of deeply nested arrays reliably exhausts the call stack and raises an uncatchable `RangeError` that terminates the request worker or process. A confirmed PoC is documented in the GHSA advisory; a patch is available in version 4.2.0 released July 13, 2026.
Prototype pollution in toml-node (npm package `toml` by BinaryMuse) prior to 4.1.2 allows unauthenticated remote attackers to write arbitrary keys onto Object.prototype by supplying a crafted TOML document to `toml.parse()`. The vulnerability exploits a path desynchronization bug in the compiler's duplicate-key guard - comma-joined tracking paths diverge from dot-joined traversal paths, allowing `__proto__` traversal through scalar values into the real JavaScript prototype chain. Injected properties propagate process-wide in Node.js and can enable denial of service, authorization bypass, or code execution via application gadget chains; the GHSA advisory includes working proof-of-concept code, and a fix is available in version 4.1.2.